In a process of scanning and removing computer viruses, existing software for scanning and removing computer viruses or computer Trojan horses checks a to-be-scanned file by matching the target file with signatures in a virus signature database. Generally, each computer virus corresponds to one virus signature record in the virus signature database, and one virus signature record corresponds to a group of signature methods (one or more functions). In a matching process, the to-be-scanned file is checked by invoking signature methods corresponding to a virus signature record. If a returned result of each signature method in this group of signature methods is that the file passes the check, the to-be-scanned file is a virus file or a virus-infected file, and the virus that infects the file is a computer virus or a Trojan horse corresponding to the virus signature record.
However, various virus signature records are generally stored in the virus signature database, which, for example, may separately correspond to panda joss-stick, Graybird, and the like. A computer needs to repeatedly execute multiple signature methods that are in multiple virus signature records, leading to low virus scanning and removing efficiency.